https://community.splunk.com/t5/Splunk-Search/Issue-with-stats-count-with-multiple-fields/m-p/406394#M190920 <P>I am using the stats count function to get a count of unique events. as part of the list I am want to show additional fields in the Statistics output. When I run my fairly simple query and use |stats count by field1 the numbers look correct. When I use | stats count by field1,field2,field3,field4 The count seems to increase more for each field I add but the strange thing is that the number of Statistics in the results does not change. For my real query I get 990 events and 142 entries on the Statistics tab for every search no matter how many fields I use in the stats count but the count for each statistic in the list grows every time I add a field.</P> Thu, 25 Jul 2019 12:55:13 GMT a238574 2019-07-25T12:55:13Z https://community.splunk.com/t5/Splunk-Search/Issue-with-stats-count-with-multiple-fields/m-p/406394#M190920 <P>I am using the stats count function to get a count of unique events. as part of the list I am want to show additional fields in the Statistics output. When I run my fairly simple query and use |stats count by field1 the numbers look correct. When I use | stats count by field1,field2,field3,field4 The count seems to increase more for each field I add but the strange thing is that the number of Statistics in the results does not change. For my real query I get 990 events and 142 entries on the Statistics tab for every search no matter how many fields I use in the stats count but the count for each statistic in the list grows every time I add a field.</P> Thu, 25 Jul 2019 12:55:13 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-stats-count-with-multiple-fields/m-p/406394#M190920 a238574 2019-07-25T12:55:13Z https://community.splunk.com/t5/Splunk-Search/Issue-with-stats-count-with-multiple-fields/m-p/406395#M190921 <P>Hi</P> <P>Try like</P> <PRE><CODE>|stats count, list(field2) as field2,list(field3) as field3,list(field4) as field4 by field1 </CODE></PRE> Thu, 25 Jul 2019 15:28:50 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-stats-count-with-multiple-fields/m-p/406395#M190921 vnravikumar 2019-07-25T15:28:50Z https://community.splunk.com/t5/Splunk-Search/Issue-with-stats-count-with-multiple-fields/m-p/406396#M190922 <P>Did some more testing trying to figure out why the count was increasing and my results got worse. I made a simple search looking to produce a set of results where the field I count by should equal the number of events...</P> <P>index=x accountid=123456789 | stats count by accountid</P> <P>The search returns 936 events but the count is 1248.... how does it get to 1248 from 936 events</P> Fri, 26 Jul 2019 12:37:48 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-stats-count-with-multiple-fields/m-p/406396#M190922 a238574 2019-07-26T12:37:48Z https://community.splunk.com/t5/Splunk-Search/Issue-with-stats-count-with-multiple-fields/m-p/406397#M190923 <P>That produces a multi line output for each unique event</P> Fri, 26 Jul 2019 15:37:38 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-stats-count-with-multiple-fields/m-p/406397#M190923 a238574 2019-07-26T15:37:38Z